Function LoadLibraryDlopen

loader_darwin.go:164–298

LoadLibraryDlopen - loads a single library using dlopen and resolves all exported symbols using dlsym. This function writes to a temporary file and then loads the file into memory, and unlinks it. This is similar to what NSLinkModule does nowadays.

(name string, image *[]byte)

// file and then loads the file into memory, and unlinks it.
// This is similar to what NSLinkModule does nowadays.
func LoadLibraryDlopen(name string, image *[]byte) (*Library, error) {
	var (
		dlopenAddr  uint64
		dlSymAddr   uint64
		dyldAddress uint64
	)

	machoFile, err := macho.NewFile(bytes.NewReader(*image))
	if err != nil {
		return nil, err
	}

	// We use the shared library cache to find the libdyld.dylib wrapper loaded into our process.
	// Once we have the address of the libdyld.dylib wrapper, we can parse it in memory using debug/macho (thanks Awgh)
	// and find the exports we're interested in: dlopen and dlsym.
	// This part of the code is a port from the awesome work of usiegl00: https://github.com/usiegl00/metasploit-framework/blob/osx-stage-monterey/external/source/shellcode/osx/stager/main.c#L159-L183
	sharedRegionStart, err := syscallSharedRegionCheckNp()
	if err != nil {
		return nil, err
	}
	dyldCacheheader := (*DyldCacheHeader)(unsafe.Pointer(uintptr(sharedRegionStart)))

	imagesCount := dyldCacheheader.ImagesCountOld
	if imagesCount == 0 {
		imagesCount = dyldCacheheader.ImagesCount
	}
	imagesOffset := dyldCacheheader.ImagesOffsetOld
	if imagesOffset == 0 {
		imagesOffset = dyldCacheheader.ImagesOffset
	}
	sharedFileMapping := (*SharedFileMapping)(unsafe.Pointer(uintptr(sharedRegionStart + uint64(dyldCacheheader.MappingOffset))))

	dyldCacheImageInfo := (*DyldCacheImageInfo)(unsafe.Pointer(uintptr(sharedRegionStart + uint64(imagesOffset))))
	for i := uint32(0); i < imagesCount; i++ {
		pathFileOffset := sharedRegionStart + uint64(dyldCacheImageInfo.PathFileOffset)
		dylibPath := readCString(pathFileOffset)
		if dylibPath == LIB_DYLD_PATH {
			dyldAddress = dyldCacheImageInfo.Address
			break
		}
		dyldCacheImageInfo = (*DyldCacheImageInfo)(unsafe.Pointer(uintptr(sharedRegionStart+uint64(imagesOffset)) + uintptr(i)*unsafe.Sizeof(DyldCacheImageInfo{})))
	}

	offset := sharedRegionStart - sharedFileMapping.Address
	dyldAddress += offset

	rawr := rawreader.New(uintptr(dyldAddress), MaxInt)
	dyldFile, err := macho.NewFileFromMemory(rawr)
	if err != nil {
		return nil, err
	}
	exports := dyldFile.Exports()

	for _, export := range exports {
		if export.Name == "_dlopen" {
			dlopenAddr = export.VirtualAddress + offset
		}
		if export.Name == "_dlsym" {